How can you prevent SQL injection when updating multiple variables in a PHP query?

To prevent SQL injection when updating multiple variables in a PHP query, you should use prepared statements with parameterized queries. This involves separating the SQL query from the user input by using placeholders for the variables and binding the actual values at execution time. This way, the input is treated as data rather than executable SQL code, effectively preventing any malicious SQL injection attacks. 

// Assume $conn is the database connection object

// Define the SQL query with placeholders
$sql = "UPDATE table_name SET column1 = ?, column2 = ? WHERE id = ?";

// Prepare the statement
$stmt = $conn->prepare($sql);

// Bind the parameters
$stmt->bind_param("ssi", $value1, $value2, $id);

// Set the values of the variables
$value1 = "new_value1";
$value2 = "new_value2";
$id = 1;

// Execute the statement
$stmt->execute();

// Close the statement and connection
$stmt->close();
$conn->close();

Keywords

SQL injection PHP query prepared statements bind variables security

Related Questions